Launch log ·
The audit produces reports, and one route can now request one
Findings, reports, and a code-gated demo route — plus the one line of the privacy contract that had to change.
The capture runner has produced sealed evidence bundles since the beginning of the month. It could not do anything with them. That gap is closed: there is now a derivation stage that turns a sealed bundle into findings, and a report stage that turns findings into a self-contained HTML file, a JSON document, and a ZIP package carrying every artifact the findings cite.
Two rules were built into the types rather than checked at the end. A finding cannot be constructed without at least one artifact id, and it cannot be constructed without naming the route it was reproduced on. There is no code path that produces an unevidenced finding and filters it out later, because there is no code path that produces one at all.
Six of the nine evidence domains have rules. Interaction probes have none. The report says so, in the domain’s own section, rather than reporting an empty result that could be mistaken for a pass. Every domain that does have rules publishes the checks it applied and the checks it could not reach with the artifacts this version captures. That list is part of the deliverable.
What changed in the privacy contract
This site had no form. It has one now, on a single route, and the change is worth stating plainly because the contract is the product.
/demo/ is a private demonstration of the audit. It is not a signup, a
waitlist, or an intake. It does nothing at all without an admin code that is
handed out one conversation at a time. When you submit it, it makes one request
to a first-party API — the only request to anything, from anywhere on this
site, that is not the page you are reading.
The specifics, which are also on the privacy page:
- The admin code is sent once in a request header, compared, and discarded. It is not written to the API’s database and not written to its request log.
- No cookie is set. Nothing is written to browser storage. Closing the tab discards the code.
- The API origin is fixed when this site is built and named in that page’s own Content-Security-Policy, so the browser refuses any other destination. It is not a field anyone can change.
- Every other page keeps
connect-src 'none'and has no form. A test asserts that the two policies differ in exactly one directive. - Reports are held for thirty days and reachable through a signed link valid for seven. After that they are deleted by a timer, not by an intention.
The demo can only be pointed at hosts the deployment was configured to audit. A demonstration that audits whatever it is told to is an open proxy with a password on it, and that is not a trade worth making to save a rebuild.
What has not happened
At publication time on 2026-08-03, nothing was deployed: the demo API had not run outside a development host and CI, and no real capture had been driven through derivation and packaging outside CI. That changed on 2026-08-04; the next launch-log entry records the first live capture and its machine-verifiable receipt. The public product gate remains open because evidence-domain coverage is still incomplete.
Checkout is still not open.